nanog mailing list archives
Re: Level3 routing issues?
From: "Jack Bates" <jbates () brightok net>
Date: Sat, 25 Jan 2003 01:45:05 -0600
From: "Dave Stewart"
Lots of traffic on udp port 1434 coming in here via TW Telecom and Sprint Looks like we may have a winner for DDoS of the year (so far)
Temporary block in place. My border cpu was starting to hammer up. Outbound stat about 2 minutes later: deny udp any any eq 1434 (445523 matches) permit ip 69.8.0.0 0.0.63.255 any (55749 matches) permit ip 206.27.138.0 0.0.1.255 any permit ip 206.30.96.0 0.0.31.255 any (97851 matches) permit ip 205.162.224.0 0.0.15.255 any (146920 matches) permit ip 205.240.128.0 0.0.15.255 any (49146 matches) permit ip 204.249.192.0 0.0.15.255 any (27351 matches) permit ip 192.133.7.0 0.0.0.255 any (5 matches) permit ip 63.136.128.0 0.0.3.255 any (379 matches) permit ip 216.226.0.0 0.0.31.255 any (27173 matches) permit ip 64.58.32.0 0.0.15.255 any (17368 matches) permit ip 206.230.34.128 0.0.0.127 any permit ip 209.54.40.0 0.0.1.255 any permit ip 206.61.140.0 0.0.0.255 any (52 matches) Inbound stat at same time: deny udp any any eq 1434 (53534 matches) permit ip any any (431556 matches) cpu load drop of about 20%....Definately a bad port. virus suspected due to inbound and outbound. Jack Bates Network Engineer BrightNet Oklahoma
Current thread:
- Re: Level3 routing issues?, (continued)
- Re: Level3 routing issues? Stephen J. Wilcox (Jan 25)
- Re: Level3 routing issues? Christopher L. Morrow (Jan 25)
- Re: Level3 routing issues? Scott Call (Jan 25)
- Re: Level3 routing issues? Neil J. McRae (Jan 25)
- Re: Level3 routing issues? Stephen Milton (Jan 25)
- Re: Level3 routing issues? Avleen Vig (Jan 25)
- Re: Level3 routing issues? Alex Rubenstein (Jan 25)
- Re: Level3 routing issues? Dave Stewart (Jan 25)
- Re: Level3 routing issues? Stephen Milton (Jan 26)
- Re: Level3 routing issues? Christopher L. Morrow (Jan 27)
- Re: Level3 routing issues? Jack Bates (Jan 25)
- Re: Level3 routing issues? Josh Richards (Jan 25)
- Re: Level3 routing issues? Kevin Day (Jan 25)
- Re: Level3 routing issues? Gary Coates (Jan 25)
- Re: Level3 routing issues? David G. Andersen (Jan 27)
- Re: Level3 routing issues? cowie (Jan 27)
- Re: Level3 routing issues? Randy Bush (Jan 27)